christianh814
commented
4 months ago @mattpoel Are you using direct OIDC setup or are you doing it with Dex? (Judging from the output I assume it's OIDC directly but want to make sure)
Closed mattpoel closed 4 months ago
christianh814
commented
4 months ago @mattpoel Are you using direct OIDC setup or are you doing it with Dex? (Judging from the output I assume it's OIDC directly but want to make sure)
mattpoel
commented
4 months ago @christianh814 my trust configuration looks like the following:
apiVersion: openunison.tremolo.io/v1
kind: Trust
metadata:
name: argocd
namespace: openunison
spec:
accessTokenSkewMillis: 120000
accessTokenTimeToLive: 1200000
authChainName: login-service
clientId: argocd
codeLastMileKeyName: lastmile-oidc
codeTokenSkewMilis: 60000
publicEndpoint: true
redirectURI:
- https://argo.demo.domain.com/auth/callback
- http://localhost:8085/auth/callback
signedUserInfo: true
verifyRedirect: trueand the configmap for the OIDC configuration:
apiVersion: v1
kind: ConfigMap
metadata:
name: argocd-cm
namespace: argocd
labels:
app.kubernetes.io/name: argocd-cm
app.kubernetes.io/part-of: argocd
data:
url: https://argo.demo.domain.com
oidc.config: |-
name: OpenUnison
issuer: https://k8sou.demo.domain.com/auth/idp/k8sIdp
clientID: argocd
requestedScopes: ["openid", "profile", "email", "groups"]
agaudreault
commented
4 months ago Usually, tls: failed to verify certificate: x509: certificate signed by unknown authority errors indicates that https://k8sou.demo.domain.com/auth/idp/k8sIdp/.well-known/openid-configuration does not have a valid trusted certificate. You can try to reproduce with curl from a container running where argo-cd is deployed. If you need to add --insecure, then you will either need a certificate trusted by a known CA, or add the root CA to the trust store.
https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#repositories-using-self-signed-tls-certificates-or-are-signed-by-custom-ca might be a way that works for argo. It is documented for repository, but since the server is making the call to the oidc provider, I think it might work too.
mattpoel
commented
4 months ago @agaudreault this was also my thinking, but I already spun up a throwaway netshoot pod in the argocd namespace to check on that, and the certificate/request to the URL was fine :neutral_face:
I now thought, a couple of restarts and re-applying the configuration can't do any harm and by:
argocd-cm ConfigMap.argocd-server pod (to get a new one running).argocd-cm ConfigMap.argocd-server pod again to get a new one up and running.:boom: I was in (because I had already signed on in OpenUnison).
I guess the restarts of the argocd-server pod fixed this. According to documentation the configuration can be done without any restarts, but in case somebody might end up with the same problem, give it a try :wink:
Thanks for your support! @agaudreault @christianh814
Kampe
commented
4 months ago I too am running into this with my sso provider as I use self signed certs I assume there's either a way to tell Dex to not verify or I guess just mount the crt.
agaudreault
commented
4 months ago Glad to hear you were able to fix it. A restart of the repo-server might be necessary. It would seem that the configs are not always updated, depending on what changes
Might be related to https://github.com/argoproj/argo-cd/issues/18576 for the SSO config reload.
Describe the bug
I've configured the OpenUnison SSO login according to documentation, but somehow I keep having a login "loop". Everytime I press the login via openunison button, I see a glimpse of the logged in web page and will directly get forwarded again to login.
Actual login works fine. Example via shell:
Follow up command:
Logs do mention a token verification failure with a tls certificat authority error message, but certificates are signed with Let's Encrypt for OpenUnison and ArgoCD. If I test the mentioned url in my browser, certificate is verified without any issue.
To Reproduce
Deploy current stable argocd version and configure OpenUnison SSO according to the documentation.
Expected behavior
Login also works via OpenUnison.
Screenshots
Version
Logs